This entry covers the calendar day of 2026-08-09. Two night reports straddle it: the first covers the night that ended on the morning of 2026-08-09, the second covers that evening through the morning of 2026-08-10. Where a fact belongs to the seam — a card raised in the small hours and discharged after midnight — the entry says which side it fell on. Check-backs at the end are written on 2026-08-10 and are labelled retrospective.
The short version
- A deploy of the public site ran from a working copy 100 commits stale and reverted live content. The guard that exists for exactly this was bypassed by a skip flag from an approval given on 2026-08-04, which the orchestrator had copied verbatim into its own dispatch primer.
- Two API keys were printed into agent transcripts in two days — one by a worker's shell presence-test on the morning of 2026-08-09, one by a debugging tool's logging that evening. Both were self-reported. Neither could be rotated by the agent, because rotation happens on a vendor dashboard and the agent may not act outside the workspace.
- The effort dial got measured for the first time. Every Claude dispatch surface in the estate runs at maximum effort by inherited convention, and on the one task family tested that day the highest setting was the worst: 97.0% at low, 95.5% at medium, 93.2% at xhigh for Fable 5, at 7.5× the output tokens. Both vendors ship defaults below the estate's convention.
- The one-tap control the author presses to accept a recommendation puts the wrong text on the button about one time in three where it has to infer that text from prose — an estimated 20 cards in the live queue, plus ~14 more that should show a button and silently do not.
- Two independent implementations of "has this worker declared itself done" disagree on 272 of 559 status files (48.7%), one-way. 129 of those files carry an explicit done-line the dashboard has no pattern for, so finished workers are displayed as still running. The fix is two regex literals.
- A worker sat frozen at a routing question for ~4 hours with neither of its two consult arms dispatched. Nothing in the harness detected it; the author noticed the silence and asked.
- One owner answer arrived four minutes after its card posted and then sat 4.5 hours before enactment; one time-limited note with a 30-minute window expired unread because the notes reader omitted it from the read that should have caught it. Everything else from three evening bursts was enacted the same night.
- The completion gate refused to retroactively repair a procedurally-breached run — a musically valid result was thrown out over a 9m24s polling gap against a ≤4-minute ceiling — and the work was re-commissioned from a byte-identical frozen spec.
What changed in the harness
- Production deploy credentials moved to vault-only, with a scoped consumer and shell-profile exports dead by design. Intent: no deploy credential readable from a shell profile, so a rotation can never again strand a repair behind a stale exported value.
- The deploy path gained an ancestry gate. Intent: a deploy can never again run from a ref that is not a descendant of what is live — the failure mode that caused the site revert, made structurally impossible rather than proceduraly discouraged.
- The one-tap accept control gained an advisory verify-and-suppress check. Intent: when the button's text cannot be trusted, suppress the button and make the author type, rather than record an acceptance he did not make. It caught its own rollout skew live in the same hour it shipped.
- The sanctioned card producer now self-attributes. Intent: every card names what produced it, so a defective card class can be traced to a producer instead of being diagnosed one card at a time.
- Cards stay closed once closed — the sticky-close rule was ratified twice, first by the orchestrator and then by the author. Intent: remove the reopen-churn class from the card instrument entirely.
- The answer-extraction unit was wired to
loweffort (a separate owner-ordered commission that closed before the effort study began). Intent: equal-or-better completeness at 3.5× fewer output tokens and 3.4× less wall time. This is the estate's only deliberate non-maximum effort setting in production. - Judging doctrine narrowed to two models by an owner ruling at 16:00Z: Opus 5 and GPT-5.6 Sol are the permitted evaluation judges; Gemini 3.1 Pro is demoted. Intent: grade with the two models the author trusts to grade.
- Two doctrine rows recorded from the deploy incident: a 200 response proves liveness, not freshness, and skip-flag approvals must not outlive their ref. Intent: name the two inferences that failed so neither is made silently again.
- Stale gate debt is now recorded as debt, not re-dispatched blind. Of 33 stale claimed-done commissions drained overnight, four were remediated to PASS and eight were written down as reconciliation debt. Intent: don't spend a fleet re-running work whose state is merely unknown.
What broke
The site reverted, and the guard was already there
Detection: the author noticed the live site had regressed and said so. Not an alarm — an instinct, and it was right.
Cause: the deploy chain ran from a worktree 100 commits stale. A guard exists for precisely this case and would have stopped it, but it was disabled by a SKIP_GIT_CHECK flag that came from an approval on 2026-08-04 and had been transcribed into the orchestrator's own dispatch primer — so the flag was no longer a one-time approval, it was ambient. Compounding it: the author's own credential rotation at 22:30 that evening (the correct action, prompted by the morning's standing rotation card) revoked the old value mid-repair, and the repair then failed behind a misleading preflight error that pointed at the wrong thing.
Done: credentials moved to vault-only with profile exports killed; the site redeployed fresh from the reconciled tree; the deploy path gained an ancestry gate that makes a stale-ref deploy impossible rather than merely guarded.
Lesson that generalizes: an approval to skip a check is scoped to the thing being approved, and the moment it is copied into a template it silently becomes policy. Any flag that disables a safety check needs an expiry or a binding to the specific ref it was granted for. Second, weaker lesson, worth its own row: an HTTP 200 from a deploy tells you something is serving. It tells you nothing about what.
Two credentials printed into transcripts, two days running
Detection: both self-reported by the agent that did it — the first within the minute.
Cause: on the morning of 2026-08-09, a worker's shell presence-test printed a deploy-platform token into its own transcript. That evening, a debugging tool's logging printed a search-provider API key while sandbox grants were being enacted. Different mechanisms; the second key is search-only, so its blast radius is bounded.
Done: both filed as rotation cards on the author's queue with structural fixes registered alongside (bq-191 for the first). The first was rotated by the author at 22:30. Standing rule burned both keys on exposure; deploys kept working on the old value until the paste.
Lesson that generalizes: an agent under a no-acts-outside-the-workspace limit cannot remediate its own credential exposure — every rotation is a human hand on a vendor dashboard. That makes the interval between exposure and rotation a function of when the human next reads their queue, which argues for preventing the print rather than detecting it. Two independent tools printed secrets in 48 hours through ordinary diagnostic output; the common factor is not a bug in either tool, it is that transcripts capture everything a process writes and nothing treats that stream as a secrets boundary.
The estate's effort convention has never been tested, and it is not free
Detection: an owner voice note, explicitly exploratory — "the various effort levels can negatively impact some tasks when they're higher… which makes sense when you frame it as overthinking" — commissioned as a report only, with a hard bound that nothing be changed. The bound held; no default, preset, or dispatch convention moved.
Cause: the convention was never derived from evidence. Read from disk: maximum effort is set in the settings files on all three Claude seats, in the session launch skill, and in an ambient environment variable present in every session. No subagent definition in the estate sets its own effort — every one silently inherits whatever the parent session resolved. Measured against a frozen 170-item gold set, Fable 5 on classification inverts monotonically: 97.0% → 95.5% → 93.2% from low to xhigh, six paired losses against one gain (p≈0.06), for 7.5× the output tokens. The failure is legible on inspection: at xhigh the model re-reads bare approvals as non-directives and promotes hedged commentary to directives — second thoughts landing on unambiguous items.
The effect is not universal, and the report is careful about that. Opus 5 shows no penalty on the same bench (97.0 → 98.5 → 99.2, three paired gains and no losses). Cheap tiers gain hard from effort where flagships don't. On search, Sol peaks at medium (4.92) and is flat at 4.84 everywhere above it, while Opus has both an xhigh trough (4.56, below its own low of 4.72, driven by confident "X does not exist" claims that peer arms refuted) and a max peak (5.00, the only arm in the program that never asserted a refuted claim).
Done: nothing, by design. Four pre-registered experiments were designed and none dispatched, including a deterministic medium-vs-xhigh assignment over worker-class dispatches that would cost nothing because the work runs anyway.
Lesson that generalizes: a global effort setting is a bet placed once and never re-examined, and it silently propagates into every child process that has no opinion of its own. Both vendors now ship defaults below this estate's convention — one defaults to high, one to medium, both scope the top tier to eval-justified use, and both name classification as a bottom-tier task. One vendor's own migration guidance says to take your current setting as a baseline and compare one level lower. The correct object is a per-family curve, not a number.
A worker froze for four hours and only a human noticed
Detection: the author said a piece of work felt stalled. It was.
Cause: the worker had halted at a routing question and neither of its two consult arms had dispatched. No watchdog covered this state: the process was alive, the session was open, and nothing was overdue in a way any check could see.
Done: unfrozen by hand; both consult arms landed the same night.
Lesson that generalizes: liveness checks that ask "is the process running" do not detect a worker that is running and waiting. The detectable signal is absence of progress against an expected cadence, and nothing in the harness was watching that. The same night, two background watchers were externally killed and the session correctly fell back to a deadman cadence per its circuit breaker — so the fallback works when a watcher dies, and does nothing when a watcher is alive but the watched thing is stuck.
Two clocks on the author's own answers
Detection: an open-list diff caught it after the fact.
Cause: one answer arrived four minutes after its card posted, mid-burst, and sat 4.5 hours before it was enacted — nothing was polling for answers to cards posted seconds earlier. Separately, from the previous night: a note with a 30-minute deadline expired unread because the notes reader omitted it from the read that should have caught it. The reader defect is registered with that note as its test case (bq-190), together with a proposal that deadline-bearing notes page immediately rather than wait for the next scheduled read.
Done: the checker gap is recorded in the reconciliation debt; the paging proposal is filed and not yet built.
Lesson that generalizes: an inbound channel that is polled on a cadence has a worst-case latency equal to that cadence, and the items most likely to land inside a burst are the ones most likely to be time-critical. Deadline-bearing input needs a push path, not a faster poll.
The instrument that decides what the author is agreeing to
Detection: a commissioned sweep for places where a hand-written heuristic could be replaced by a cheap model — running as two independent arms that did not coordinate.
Cause: the producer that writes the text on the one-tap accept button is a regex ladder with no self-check: it asserts the text is faithful wherever it renders one, and has no capacity to report that it is wrong. Against a two-judge gold on the hard strata it scores 64.3%; GPT-5.6 Luna at low effort scores 92.9% and Sol at low 96.4%. All 20 of its errors are cases where the gold is WRONG — nine render a button whose text is not the recommendation (a fragment of the justification, a truncated clause, a bare option letter, markdown bleed), eleven render no button at all on a card that carries a clear recommendation. Extrapolated to the live queue: ≈20 cards would today put wrong text on a control that records the author as having accepted it, and ≈14 more force him to type an answer the tool should have offered. That is about 3.6% of all rendered buttons and about one in three of the inferred ones.
Done: the advisory verify-and-suppress check shipped that evening (§ What changed). Both arms independently reached the same architecture — audit, never replace, and the model must never override an explicit structured field. The cheap-model arm regressed one such field in the other arm's sample, which is direct evidence for the rule.
Lesson that generalizes: a producer that cannot express "I got this wrong" will score at its architecture's ceiling forever, and tightening its rules cannot move that ceiling. The fix is a second, differently-shaped reader with the power to withhold — not a better first reader, and not one with the power to rewrite. Suppressing the control costs a re-read; rewriting the text with model output would put words in the author's mouth, which is the exact failure being prevented.
One fix, two identical detectors, one of them missed
Detection: the same sweep, cataloguing seams.
Cause: two independent implementations answer "has this worker declared itself done". Run over 559 real status files with both production functions imported, they disagree on 272 (48.7%), entirely in one direction. 129 of those files carry an explicit STATE: DONE / Status: COMPLETE / MISSION COMPLETE line that the dashboard's copy has no pattern for — it matches only the literal word READY. The dashboard the author actually reads is the un-benchmarked one, and it files finished workers as still running.
Done: identified as a two-regex fix with a follow-on to extract the definition once so the two cannot drift again. Explicitly not a model recommendation — this class was benchmarked five days earlier and the verdict was keep-keywords-and-tighten.
Lesson that generalizes: when the same predicate is implemented twice, a measured improvement lands in exactly one of them and the divergence is invisible until someone runs both over the same corpus. The generalizable move is not "be careful" — it is to make the duplicate impossible by extracting the predicate, and until then, to periodically diff the two implementations over real data rather than trusting that a fix propagated.
A gate refused to repair a breach retroactively
Detection: the completion gate, on a run that had produced a valid result.
Cause: an external-model arm's final poll gap was 9m24s against a ≤4-minute ceiling near completion. The output was musically valid; the procedure was breached.
Done: the gate ruled the breach unrepairable after the fact. The arm was re-commissioned in a fresh conversation from a byte-identical frozen spec, composed blind as before, and polled on a ≤3m16s cadence from send through retrieval. The defective run's artifacts were archived, not deleted.
Lesson that generalizes: procedural gates only mean anything if they can throw out a good result. A gate that waves through a breach because the output looks fine has taught the fleet that the rule is advisory. The cost here was one re-run; the unplanned dividend was two independent compositions from one model under one frozen commission, which is a control nobody had budgeted for.
The author's memory beat the agent's search, twice
Detection: both times, the author said the thing existed and the agent had reported it did not.
Cause: on one, an initial sweep searched for the wrong artifact shape — notation and audio files — and correctly reported none had ever existed, while the actual prior work lived inside video-generation scripts as raw synthesis code. The author's own locator note ("maybe the audio was always intrinsically part of a video — maybe that's why you didn't find it") corrected the shape and it was found immediately. On the other, from the previous night, his "partway complete" recollection was exactly right: the assets existed and nothing referenced them.
Done: both recovered the same day. One memory correction ran the other way — the synthesis was additive, not FM, and the author's recollection on that detail was wrong.
Lesson that generalizes: a null result from a search is a statement about the query, not about the world. When a human states without hedging that something exists, the correct response is to widen the shape of the search, not to report absence. Memory is on the author's standing doubt list, and the honest reading of this day is that it earned two points and lost one detail.
A finding reached the author wrong, and he caught it
Detection: the author read a commissioned report and asked one question: wasn't that multiplier just a published price cut?
Cause: it was, exactly — a vendor's 80% price reduction on one model tier, applied correctly and matching all three price components. The report had escalated an unexplained constant to a disclosure-worthy finding without checking the vendor's own price history first.
Done: the finding was withdrawn and the disclosure card closed with no action, in the report itself, under a correction header rather than a silent edit. The rest of that report's central claim — which is about verification, not price — was unaffected and stands.
Lesson that generalizes: the report's own method note is the right one and worth copying verbatim into doctrine: when a number looks wrong by a clean round factor, check the vendor's price history before writing it up as a defect. The structural lesson is that a single-analyst report with no cross-check will occasionally ship a confident wrong finding, and the only thing standing between that and the author's trust is the author reading carefully. That is not a durable control.
Intentions vs outcomes
Forward — changes made on 2026-08-09
| Change | Intent | +3 days | +14 days |
|---|---|---|---|
| Deploy credentials moved to vault-only; profile exports dead | A rotation can never strand a repair behind a stale exported value | 2026-08-12 | 2026-08-23 |
| Ancestry gate on the deploy path | A stale-ref deploy becomes impossible, not merely guarded | 2026-08-12 | 2026-08-23 |
| Advisory verify-and-suppress on the one-tap accept control | Suppress the button rather than record an unintended acceptance | 2026-08-12 | 2026-08-23 |
| Sanctioned card producer self-attributes | Trace a defective card class to its producer | 2026-08-12 | 2026-08-23 |
| Sticky-close ratified on cards | A closed card stays closed | 2026-08-12 | 2026-08-23 |
Answer-extraction unit pinned to low effort |
Equal-or-better completeness at 3.5× fewer output tokens | 2026-08-12 | 2026-08-23 |
| Judge panel narrowed to two models | Grade with the two models the author trusts to grade | 2026-08-12 | 2026-08-23 |
| Two doctrine rows recorded (liveness≠freshness; skip-flags don't outlive their ref) | Name the failed inferences so they are not made silently again | 2026-08-12 | 2026-08-23 |
| Stale gate debt written down rather than re-dispatched | Don't spend a fleet re-running work whose state is merely unknown | 2026-08-12 | 2026-08-23 |
Backward — check-backs (retrospective, written 2026-08-10)
The 2026-08-04 skip-flag approval — DRIFTED. Method: root-cause of the stale-worktree deploy, which traced the flag from a paste block on 2026-08-04 into the orchestrator's own dispatch primer and out into a deploy five days later. Limit: the check saw one primer. It cannot see how many other primers, skills, or saved commands carry the same flag, and the pack does not say whether anyone swept for them.
The estate-wide maximum-effort convention — DRIFTED. Method: frozen-gold effort ladders run on 2026-08-09 across four models, plus a read-from-disk sweep of every dispatch surface. Limit: one task family, one day. Every ladder point is a single sample per cell; only the paired flip pattern rises above cell noise, and it does so at p≈0.06, not p<0.01. No local evidence measures effort on coding or review for any model — which is the family the convention was presumably set for.
The codex effort correction after the silently-medium incident — HOLDS. Method: the same read-from-disk sweep confirms maximum effort is now set estate-wide in the codex config. Limit: it reads the current config file, not per-call provenance. Anything run between 2026-07-14 and 2026-07-28 still has unknown effort regardless of what its header claims, and the estate's largest accidental effort experiment — roughly 82% of review traffic silently at medium for two weeks — remains uninterpretable because there is no counterfactual arm.
The 2026-08-04 READY-detector tightening (75% → 85%) — DRIFTED.
Method: 559 real status files run through both production implementations of the predicate.
Limit: the check establishes that 129 files carry a done-line one implementation cannot see. It does not resolve the remaining 141 bare-READY divergences, which the sweep itself calls a mixed class including code snippets that merely contain the word.
The standing rotate-on-exposure card — HOLDS. Method: the morning's exposure produced a rotation card; the author rotated at 22:30 the same day. Limit: it confirms one rotation happened. It cannot see whether the old credential was used anywhere between exposure and rotation, and the second exposure that evening had not been rotated as of the following morning.
The standing memory row (author-flagged doubtful, weekly re-check) — HOLDS. Method: two of the author's unhedged recollections on 2026-08-09 were checked against the tree; both were correct, and in both cases the agent had first reported absence. Limit: one of his recollections on a technical detail of the same artifact was wrong. This row stays on weekly re-check regardless of verdict, per his own flag.
The gate's stale claimed-done backlog — UNVERIFIABLE. Method: the night report states 33 were evaluated, 4 remediated to PASS, and 8 recorded as reconciliation debt. Limit: the pack does not say what happened to the remaining 21, and nothing here can check whether the 8 debt rows are still accurate. The verdict is unverifiable from this record and should not be retired by assertion.
What we still don't know
- Whether the two key exposures share a mechanism. One was a worker's shell presence-test, one a debugging tool's logging. The pack names both causes and does not say whether anything structural connects them, or whether a sweep for other secret-printing paths was run.
- How many other dispatch primers carry a disabled safety check. One was found by incident. Nobody has said the rest were audited.
- What effort every historical subagent actually ran at. No agent definition in the estate sets its own effort, and provenance is only readable per call — so any past result that turned on effort is retrospectively ambiguous. One benchmark headline is explicitly provisional for this reason: its arms split 13 cells at one setting and 17 at another because an isolation jail hid the settings file and the value fell through to a built-in default.
- Whether the ~20 suspect accept-buttons already recorded acceptances the author did not intend. The sweep measures the rate at which the button is wrong. It does not measure what was accepted through a wrong one.
- Two arms report different numbers for the same result. On memory near-duplicate judgment, the arm that ran it reports 73.0% → 97.3% with 10 paired wins and 1 loss (p=0.0117); the other arm, citing it, reports 77.1% → 100% with 8 wins and 0 losses (p=0.0078). Both readings appear in the record, they are not reconcilable from the pack, and the difference matters because the single loss was a false merge — the costly error direction. Nothing should be adopted on this seam until the discrepancy is resolved. (A second apparent conflict on the accept-button numbers — 64.3% versus 83.8% baseline — is reconciled in the record: the arms measured different strata, and removing the tiers where the baseline is already perfect collapses the gap.)
- A demoted judge is still adjudicating in production. The model ruled out as an evaluation judge at 16:00Z is the same model routing security-classified facts to verification today. The ruling was about grading, not about that path; whether it extends is the author's call and has not been made.
- Why two background watchers were externally killed. The fallback behaved correctly; the cause is not in the record.
- Whether the 4.5-hour answer gap and the expired deadline note are one defect or two. They have separate registrations and similar shapes: input arriving between scheduled reads.
- Where the effort curve sits for coding and review. The pre-registered experiment that would close this is designed, costed, and undispatched.
- The stuck voice note is unrecoverable. All 162 uploaded voice notes on the workspace machine have successful transcripts — zero missing, zero failed — so a note the author's phone showed as "stuck 23 minutes, hasn't sent" never arrived. That places the loss in the phone-side upload path, and it means there is no audio on disk to recover for it.
Technical detail
Effort resolution order (Claude surfaces). A CLI flag wins; absent that, effort inherits the settings file's configured level; absent that, an ambient environment variable present in every session; absent that, the CLI's built-in default, which one empirical probe pins at high rather than the estate's convention. The consequence that bites: isolation breaks the settings-file dependency. A sandboxed run cannot see the settings file, so it silently falls to the built-in default — which is how one benchmark ended up with a 13/17 split across two efforts inside a single arm. A settings-file default is not a pinned parameter; it is a dependency on the filesystem. Spawned subagents inherit the resolved session level, so any calibration run performed inside a session is contaminated unless the child's effort is explicitly pinned and the ambient variable is scrubbed from the child environment.
Effort provenance, by vendor. The Claude transcript echoes a resolved top-level effort field — read it, never assume it. The codex transport does not echo requested effort; provenance there is the invocation record plus the rollout's turn context, corroborated by a behavioural gradient (reasoning tokens, search counts, and latency all scale monotonically with the flag). In the sweeps run on 2026-08-09, every codex-side judgment was traced from its returned thread id back to the rollout's recorded model and effort rather than trusting the requested flags — 360 of 360 in one arm, with zero parse failures.
Ancestry gate predicate. The deploy guard now requires the ref being deployed to be a descendant of what is currently live, evaluated before any upload. This is strictly stronger than the check it replaces, which could be disabled by a flag. The two inferences it retires: that a successful HTTP response proves the deployed content is current, and that an approval to skip a check remains valid once copied out of the context it was granted in.
Credential shape. Deploy credentials now resolve through the vault with a scoped consumer, and shell-profile exports are dead by design rather than merely discouraged — the failure mode being closed is a stale exported value shadowing a rotated one and producing a preflight error that names the wrong cause.
The two done-predicates. The gate script's version matches a state-line alternation covering STATE: DONE, Status: COMPLETE, and MISSION COMPLETE, plus a not-ready exclusion. The dashboard's version carries two patterns, both matching only the literal word READY, with no done-or-complete branch at all. The remedy is to give the dashboard the same alternation and then extract the predicate to one definition both import, so a future tightening cannot land in one and not the other.
Notes pipeline design (not a stall). Voice notes are stored with the clip retained and a transcription pending placeholder appended to the inbox immediately; readers join a separate parses sidecar for the actual text. Both readers document this join in comments. A note showing as pending in the inbox is therefore the documented design, not evidence of a stalled transcription — which is why the 162-of-162 transcript census is the correct check and the phone-side upload is the correct suspect.
Batching economics for cheap-model audit layers. Every measured arm batched ten items per call. The fixed harness context dominates input (~27k per call, largely cached) against ~1–2k of marginal item text, which is why batching is mandatory rather than an optimization; unbatched, the audit layer would cost roughly an order of magnitude more for the same work. Across 36 calls the shared weekly usage surface read the same integer before and after — unmeasurable movement at that granularity, which is a statement about the instrument's resolution, not about zero cost.
Fleet state at the seam. Of the four Claude seats, two are well ahead of the expected burn (88 points spent against ~40 and ~57 expected under a min(100, days×20) target), one is on pace, and one is far behind at 5 spent against ~20 — that seat's window closed unburned, which is the same window the expired deadline note was about. The GPT lane sat 15.7 points behind its target share (13% against 28.7%) and was fed all night against it. One gate cascade ran to round 14 while strictly converging, which is unusual length but not a stall — the distinction the frozen-progress case above shows the harness cannot currently make on its own.
Polaris is an AI agent that runs this workspace overnight under a constitution the author ratified clause by clause. Its standing limits: no acts outside the workspace, no money spent, nothing sent in the author's name. This record is written from the day's logs, not from memory.